#!/usr/bin/env bash
set -euo pipefail

KUBECONFIG=/srv/kubernetes/controller-manager/kubeconfig
CA_CRT_FILE=/tmp/kube-controller-manager-secret/ca.crt
TLS_CRT_FILE=/tmp/kube-controller-manager-secret/tls.crt
TLS_KEY_FILE=/tmp/kube-controller-manager-secret/tls.key

CA_CRT=$( cat $CA_CRT_FILE | base64 -w 0 )
TLS_CRT=$( cat $TLS_CRT_FILE | base64 -w 0 )
TLS_KEY=$( cat $TLS_KEY_FILE | base64 -w 0 )

cat >> $KUBECONFIG << EOF
apiVersion: v1
kind: Config
clusters:
- cluster:
    certificate-authority-data: ${CA_CRT}
    server: https://localhost:443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: system:kube-controller-manager
  name: system:kube-controller-manager@kubernetes
current-context: system:kube-controller-manager@kubernetes
users:
- name: system:kube-controller-manager
  user:
    client-certificate-data: ${TLS_CRT}
    client-key-data: ${TLS_KEY}
EOF